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What is claimed is :- i 

1. A method for identifying a transaction corresponding 
to a plurality of servilce packets communicated between a 
source node and a destination node, comprising: 

providing a communications data set comprising a 
5 plurality of service packets and information relating to the 
order in which said servibe packets are communicated on a 
communications line betwee^ a source node and a destination 
node ; and 

comparing said communications data set against a pattern 
10 qharacterization data set comprising information relating to 



a predetermined ordering of 
a transaction to determine w 
plurality of service packets 



service packets corresponding to 
7^ther at least a portion of said 
correspond to said transaction. 



2. The method as fclaimted in Claim 1, wherein t said 
communications data set includes a received time corresponding 
to each service packet and sJid providing step comprises: 

reading with a probe skid service packets from said 
communications line; and 1 

recording said service packets and said received time, 
wherein said received time corresponds substantially to the 
time said packet is read by sakd probe. 



3. The method as claimed in Claim 2, wherein said probe 
is 'located between said source and destination nodes anJ 
further comprising: 
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25 adding to said \received time for a received packet a 

transit time corresponding substantially to the time required 
by a service packet to\ travel from said probe to at least one 
of said source node and destination node. 

4. The method as claimed in Claim 1, wherein a 
30 plurality of said service packets have at least one of a node 
address and port number and said communications data set 
includes a received time corresponding to each service packet 
and said providing step comprises : 

reading with a probfe said service packets from said 
35 communications line; 

filtering said servi^eTpa&kets based on at least one of 
node address and port num£er\tjo form filtered service packets; 
and 

recording said filtered Service packets and said received 
time, wherein said received time corresponds substantially- to 
the time said filtered servick packet is read by said probe. 

5. The method as claimed in Claim 1, wherein said 
service packets correspond to a\ plurality of threads with each 
thread corresponding to thread ^Identification information and 
45 said comparing step comprises 

sorting said service packers in said communications data 
set into a plurality of thread data sets wherein the service 
packets in each thread data \set have the same threaJ 
identification information 
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6. The method as claimed in Claim 1, wherein said 
service packets include service request packets and service 
results packets, each service request corresponds to a service 
request, and said comparting step comprises: 

identifying servicl request packets in said service 
packets based on the consents of said service packets. 

7. The method as 1 claimed in Claim 1, wherein said 
service packets include service request packets and service 
results packets and said Comparing step comprises: 

identifying service 1 request packets in said service 
packets based on the contents of said service packets; 

correlating service Results packets with corresponding 
service request packets; amd 

determining the sta£t\ jand stop times for the service 

request . 

8. The method as \claimed in Claim 7, further 
comprising : 

computing a response tile for said transaction, 

9. The method as dlaimed in Claim 1 ' further 
comprising : 

comparing the time internal between the stop of a first 
service request and the star! of a second service request 
against a predetermined valul for said time interval to 
' ' identify a sequence of servicl requests corresponding to - 
transaction, wherein said predetermined ordering of service 
packets corresponds to said sequence of service requests. 
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10. The method \as claimed in Claim 1, wherein said 
service packets correspond to a plurality of service requests 
and said comparing step\ comprises : 

first matching a\ first service request in said 
communications data set With 'a first service request in said 
predetermined ordering of service packets; 

second matching a \ second service request in said 
communications data set with a second service request in said 
predetermined ordering ofi service packets, wherein a time 
85 interval between said first and second service requests is no 
more than a predetermined Value . 

11. The method as /claimed in Claim 1, wherein said 
service packets corresponlufi a plurality of service requests, 
said service requests correspond to a plurality of thread data 
sets, and said comparing steb comprises: 

first matching a first service request corresponding to 
a first thread with a fiist service request in said 
predetermined ordering of service packets; 

second matching a second service request corresponding to 
9 5 a second thread with a secold service request in said 
predetermined ordering of service packets, wherein a time 
interval between said first and second service requests is no 
more than a predetermined value. 
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■12. A non- intrusive system for identifying a transaction 




100 corresponding to a plurality of service packets communicated 

1 

between a source node and a destination node, comprising: 

means for recording a plurality of service packets 
communicated on a communications line between a source node 
and a destination node,! said recording means being in 
105 communication with said communications line; and 

means, in communication with said recording means, for 
identifying a transaction corresponding to at least a portion 
of said plurality of pack^ts^ 

13. The non- intrusiv^A ^sys tern as claimed in Claim 12, 
! J3 110 wherein said identifying meahs comprises means for comparing 
said plurality of service packets and the order in which said 
service packets are received by said recording means against 
a predetermined ordering of sirvice packets relating to said 

transaction. \ 
115 i4. The non-intrusive system as claimed in Claim 12, 

wherein said recording means is\ located on a portion of said 
communications line between said\source and destination nodes. 
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15. A method for Identifying a transaction corresponding 
to a plurality of service packets communicated between a 
120 source node and a destination node, comprising: 

providing a communications data set comprising (i) a 
plurality of service packets 'corresponding to a plurality of 
service requests and (ii)\ the start and stop times for each 
service request; and 
125 comparing the time interval between the stop of a first 

service request and the start of a second service request 
against a predetermined value for said time interval to 
identify a sequence of said lervice requests corresponding to 
a transaction. 

P: 130 16. The method as claimed in Claim 15, wherein said 

predetermined value rangig^JErom about 50 to about 500 
milliseconds . 

O 17. The method as claimed^ in Claim 15, wherein a portion 

of said service packets correspond to a thread and at least 
two service packets correspond \.o different threads and said 
service packets comprise a plurality of service request 
packets and service result packette corresponding to different 
service requests and said comparing step comprises: 

identifying service request \ packets in said service 
140 . ..packets ; 

Correlating service result packets with corresponding 
service request packets to form a plurality of service data 
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subsets with the service packets in each service data subset 
corresponding to a service request; and 

sorting said service data subsets by thread to form a 
plurality of thread data sets of service requests with the 
service packets in said tliread data set having the same thread 

addresses. ^ 

18. The method as \ claimed in Claim 15, wherein a 
plurality of sequences of\ service requests correspond to a 
plurality of transactions \nd said comparing step comprises: 

recording each of saidl sequences of service requests and 
t.he number of occurrences \ of each sequence in a pattern 
characterization data set. 

19. The method as cuLaimed in Claim 15, further 



comprising: 



selecting a second pred 



ermined value; 



comparing said time interval against said second 
predetermined value to identity a second sequence of said 
service requests corresponding \ to a second transaction; and 

recording each of said feecond sequences of service 
requests and the number of occurrences of each of said second 
sequences in a second data set 

20. The method as claimed in Claim 19, further 

comprising : 

.^electing a third predetermined value based on the 
relationship between (i) the nuniber of said sequences of 
service requests and said predetermined value and (ii). the 




number of said second s 



tquences of service requests and said 



170 second predetermined value 



21 . The method 



ls claimed in Claim 20, further 
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comprising : 

comparing said time -interval against said third 
predetermined value for s\aid time interval to identify a third 
175 sequence of said service^ requests corresponding to a third 
transaction . 

22. The method as\ claimed in Claim 21, further 
comprising: 

comparing said third sequence against said communications 
data set to determine whether at least a portion of said 
plurality of service packetk correspond to said transaction. 

23. The method as f ^Laimed in Claim 22, further 
comprising : 

computing a response tiAe for said transaction 
185 24. The method as claimed in Claim 15, wherein said 

comparing step produces a pattern characterization data set 
listing a plurality of sequences of' service requests and 

further comprising: 

second comparing said sWrvice requests from said 
190 comparing step with said pattern\characterization data set to 
determine if said service requests are contained in said 
pattern characterization data set 
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25. "The method as llaimed in Claim 15, wherein said 
first service reqiiest corresponds to a first thread and said 
second service request corresponds to a second thread. 
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26. A non- intrusive system for determining transaction 
level activity between a source node and a destination node, 
comprising : 

means for recording a plurality of service packets 
communicated on a communications line between a source node 
and a destination node, wherein said service packets relate to 
a number of transactions and said recording means is in 
communication with said communications line/ and 



means for determining said number of transactions in 
205 communication with said recording means. 

27. The non-intrusive system as claimed in Claim 26, 
wherein said determining Akans comprises means for comparing 



said plurality of servic 



service packets are receive 



pkpkets and the order in which said 



220 



by said recording means against 
a predetermined ordering o^^ervice packets relating to. .said 
transaction . 

28. The non-intrusive \ system as claimed in Claim 26, 
wherein at least a portion of \said plurality of packets relate 
to different service request! packets, said recording means 
provides a first data set including (i) said plurality of 
packets and (ii) the start aid stop times for each service 
request, and said determining means comprises means for 
comparing the time interval between the stop time of a first 
service request and the start tilne of a second service request 
against a predetermined value \ for said time interval to 
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identify a sequence of(j^d service requests corresponding to 
a transaction. 
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